Hi @ Corrine Chen ,
Just wondering if you set up quarantine policies?
After EOP inspects the mails, if malware is found in the message or attachment, the message is delivered to quarantine.
For normal mail, as Andy said, it will be routed to an on-premises mailbox and will not be saved in the cloud.
Please refer to this link for the workflow of EOP :Exchange Online Protection (EOP) overview - Office 365 | Microsoft Learn

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.